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1 CLAIMS 



What is claimed is: 

1. A computerized method for fast virus scanning of a file comprising: 

storing anti-virus state information for the file in a data structure associated with 
the file and managed! by a file system; and 

obtaining the anti-virus state information for the file from the data structure when 
the data structure has been retrieved by the file system. 

2. The computerised method of claim 1, wherein the data structure is a directory 
entry for the file and the anti-virus state information is stored in a field in the directory 
entry. \ 

3. The computerized method of claim 2, further comprising: 

partitioning the antl- virus state information into segments, each segment being 
equal in size to one of a plurality of fields in the directory entry. 

4. The computerized mqthod of claim 2, further comprising: 
creating at least one field in the directory entry. 

5. The computerized method of claim 1, wherein the data structure is an extra file 
fork for the file. \ 

6. The computerized method of claim 5, further comprising creating the extra file 
fork to hold the anti-virus state information. 
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7. The computerized method of claim 1, wherein the data structure is stored as a 
resource within a resource fork for the file. 

8. The computerized method of claim 1, further comprising: 

encrypting the anti-virus state information before storing it in the data structure; 
and \ 

decrypting the anti-virus state information when it is obtained from the data 
structure. \ 

9. The computerized method of claim 1, further comprising: 

comparing the anti-virus state information stored in the data structure against 
corresponding information associated with a current version of the file to determine if 
virus scanning is required; ana 

updating the anti-virus state information if the file is scanned as a result of the 
comparison. \ 

10. The computerized methodW claim 1, wherein data structure is retrieved by the file 
system as a result of the file being accessed by an application program. 

11. The computerized method of claim 1, wherein data structure is retrieved by the file 
system as a result of a user requesting y\e file be scanned. 

i 1, wherein data structure is retrieved by the file 
defined list of files scheduled for scanning. 



12. The computerized method of clai* 
system as a result of the file being in a pr 
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1 13. A computer-readable medium having stored thereon executable instructions that 

2 cause a computento execute a virus scanning method on a file, the method comprising: 

3 storing ami-virus state information for the file in a data structure associated with 

4 the file and manageu by a file system; and 

5 obtaining the anti-virus state information for the file from the data structure when 

6 the data structure haspeen retrieved by the file system. 



ci 



1 14. The computer-readable medium of claim 13, further comprising: 

2 encrypting the an\i-virus state information before storing it in the data structure; 

3 and 

4 decrypting the anti-^irus state information when it is obtained from the data 

5 structure. 

1 15. The computer-readableyiedium of claim 13, further comprising: 

2 comparing the anti-virus\state information stored in the data structure against 

3 corresponding information associated with a current version of the file to determine if 

4 virus scanning is required; and 

5 updating the anti-virus state \nformation if the file is scanned as a result of the 

6 comparison. 



1 16. The computer-readable medium W claim 13, wherein the data structure is a 

2 directory entry for the file and the anti-vifys state information is stored in a field in the 

3 directory entry. 

1 17. The computer-readable medium of clai^i 13, wherein the data structure is an extra 

2 file fork for the file. 
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^J^T The computer 



creating 



-readable medium of claim 17, further comprising: 
he extra file fork to hold the anti-virus state information. 



<20C A computer system comprising: 

a processor coupled to a system bus; 

a memory coupled to the processor through the system bus; 

a computer-readable medium coupled to the processor through the system bus; 

a file system executed from the computer readable medium by the processor, 
wherein the file system causes the processor to store data structures associated with files 
on the computer-readaple medium and further to retrieve the data structures from the 
computer-readable medium; and 

an anti-virus process executed from the computer readable medium by the 
processor, wherein the anti-virus process causes the processor to store anti-virus state 
information for the file in the data structure associated with the file and further to obtain 
the anti-virus state information for the file from the data structure when the data structure 
has been retrieved. 



.0 



The computer system of claim <: 20C'wherein the anti-virus process further causes the 
processor to encrypt the anti-virus state information before storing it in the data structure 
and to decrypt the anti-virus state information when it is obtained from the data structure. 

2?i. The computer system of claim^OTwherein the anti-virus process further causes the 
processor to compare the anti-virus state information stored in the data structure against 
corresponding information associated with a current version of the file to determine if 
virus scanning is required and to update the anti-virus state information if the anti-virus 
process causes the processor to scan the file as a result of the comparison. 
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1 -39^ The computer system of clain^2u, wherein the data structure containing the anti- 

2 virus state information is an entry in a file system directory and anti-virus process further 

3 causes the processor to store the anti-virus state information in the entry and to obtain the 

4 anti-virus state information from the entry. 

1 The computer system of claim^flfwherein the data structure containing the anti- 

2 virus state information is an extra file fork for the file and the anti-virus process further 

3 causes the processor Vo store the anti-virus state information in the extra file fork and to 

4 obtain the anti-virus state information from the extra file fork. 

1 J2& The computer system of claim^f, wherein the anti-virus process further causes the 

2 processor to create the qxtra file fork to hold the anti-virus state information. 

1 *26T The computer system of claim^^tfTwherein the data structure containing the anti- 

2 virus state information is stored as a resource in a resource fork for the file and the anti- 

3 virus process further caused the processor to store the anti-virus state information in the 

4 resource fork and to obtainithe anti-virus state information from the resource fork. 



1 2^. A computer-readable medium having stored thereon a directory entry data 

2 structure for a file system coinprising: 

3 a file identifier field containing data representing a file system identifier for a file; 

4 and 

5 a first reserved field containing data representing an anti-virus state for the file 

6 identified by the file identifier fiel 
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1 <28T* The computer-readable medium of claim^v wherein the file comprises a data fork 
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and a resource fork, the first reserved field contains data representing a two-byte 
checksum for the file and data representing two bytes of a three-byte length for the 
resource fork, an i further comprising: 

i eserved field containing data representing a third byte for the resource 
; ita representing a three-byte length for the data fork. 



a second 
fork length and d; 



1 .29^ A computer-readable medium having stored thereon a file fork data structure 



associated with a file comprising: 

a file identifier field containing data representing a file system identifier for the file; 



and 



a resource fi 



eld containing data representing an anti-virus state of the file identified 



by the file identifier field. 
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